@RolesAllowed not working in EJB3

[chrismalan]

All session bean implementations have the required @SecurityDomain("theDomain") annotation.

What does not work is that once somebody has logged in, he can call any session bean method, even those calling for a role he is not in.

This is in JBoss 4.0.3. This has worked fine before in EJB 2.1. My login code and login-config.xml are all still the same.

Any idea what is going on? I did look at the EJB3 tutorial, again.

Thanks,

[kenfrommera]

Hello, does anyone use JBoss? :-/

I am experiencing the same problem with JBoss 4.2.0.GA. What is wrong?

[anil.saldhana]

Ask in the ejb3 forums or create a bug report in JIRA for them to have a look at it.